Hi All,   We are planning an upgrade for our really old universal forwarders from 6.1.2 to 8.1.x and seems like now the documentation for these really old forwarders are not there .can someone guide as to how the upgrade process should go and the intermediate versions we need to upgrade to ?   I was thinking to directly install a new version of splunk UF (8.1.x)and shift my configs there and the fish bucket directory ,would that be a sane approach without re indexing anything ,or there are different things that need to be considered?. ... View more

Hi All,   We have an index that is growing very rapidly and we want to now move it to a new partition specifically for that index in our cluster ,what steps should i follow to do that and with minimal downtime  ?   Thanks and regards, Chiranjeev Singh ... View more

Hi All ,   We have a sensitive field that we mask regularly ,but a use case has come where we have to store the particular filed as it is (without masking) based on a  field value .does anyone have faced any case like that before ? current scenario  customer_data ==xxxx  specific_filed=abc customer_data ==xxxx  specific_filed=def customer_data ==xxxx  specific_filed=ghi expected output  based on an adhoc request we have to unmask now the incoming data for field abc customer_data ==12345 specific_filed=abc customer_data ==xxxx  specific_filed=def customer_data ==xxxx  specific_filed=ghi   ... View more

Hi All, I am planning to implement SmartStore in my current splunk environment and wanted to know if i am only doing it for few indexes in my cluster do i still have to change and make the SF=RF in my cluster master. Also if you could list the best practices that worked for you while implementing it ,that would be helpful as well.   Thanks, Chiranjeev Singh ... View more